Description
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | musl libc | 1.1x before 1.1.2, 0.9.13 through 1.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | musl | 1.1.4-1 | — |
| Debian 13 | musl | 1.1.4-1 | — |
| Debian 12 | musl | 1.1.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | musl | 1.1.9-1ubuntu0.1~esm2 | USN-4768-1 |
| Ubuntu Pro 14.04 LTS | musl | 0.9.15-1ubuntu0.1~esm1 | USN-4768-1 |
Advisories 1
- USN-4768-1 musl vulnerabilities Ubuntu Security Notices (USN) · Jun 29, 2026